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GET http^/sportsillustrated.cnn.com/golfonline/ HTTP/1.0 

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.11 [en] 

Host: sportsillustrated.cnn.com 

Accept: text/html, image/png, image/jpeg, image/gif, image.x-xbitmap, *.*;q=0.1 
Accept-Language: en 

Accept-Charset: windows-1252, utf-8, utf-16, iso-8859-l;q=0.6, *;q-0.1 
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 
Cookie: CNNid=Gcfl947e6-970341-1058041384145-l 
Cookie2: $Version=l 
Proxy-Connection: close 



FIG. 8 



POST http^/sportsillustrated.cnn.com/golfonline/ HTTP/1.0 

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.11 [en] 

Host: sportsillustrated.cnn.com 

Accept: text/html, image/png, image/jpeg, image/gif, image.x-xbitmap, *.*;q=0.1 
Accept-Language: en 

Accept-Charset: windows-1252, utf-8, utf-16, iso-8859-l;q=0.6, *;q-0.1 
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 
Cookie: CNNid=Gcfl947e6-970341-1058041384145-l 
Cookie2: $Version=l 
Proxy-Connection: close 

form_valuel=valuel&form_value2=value2 



FIG. 9 
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HTTP/1.1 200 OK 

Server: Netscape-Enterprise/6.1 AOL 
Date: Sat, 19 Jul 2003 18:58:21 GMT 
Expires: Sat, 19 Jul 2003 18:59:21 GMT 
Cache-control: private, max-age=60 
Content- type: text/html 
Content-length: 255 
Connectionxlose 

[HTML DATA] 



FIG. 10 



GET /.hash=d0633flbfdd0fde48cf351e£8c541b67567426dd HTTP/1.1 
Host: 123.52.193.31:1214 

User-Agent: KazaaClient Jul 20 2003 23:23:10 
X-Kazaa-Username: logn 
X-Kazaa-Network: KaZaA 
X-Kazaa-IP: 64.57.225.216:1214 
X-Kazaa-SupernodelP: 66.75.205.152:1490 
Connection: close 
X-Kazaa-Xferld: 11312345 

X-Kazaa-XferUId:ytCcDgo+3sTohN12+lY2jYkCY6NwCA= 



FIG. 11 



GET /14587/Michael+Jackson+Thriller.mp3 HTTP/1.1 
Host: 123.52.193.31:1214 

User-Agent: KazaaClient Jul 20 2003 23:23:10 
X-Kazaa-Username: logn 
X-Kazaa-Network: KaZaA 
X-Kazaa-IP: 64.57.225.216:1214 
X-Kazaa-SupernodelP: 66.75.205.152:1490 
Connection: close 
X-Kazaa-Xferld: 8975270 



FIG. 12 



Docket #091353-1 
Page 11 of 12 



HTTP/1.1 200 OK 

Content-Length: 6525402 

Accept-Ranges: bytes 

Date: Sun, 20 Jul 2003 23:25:50 GMT 

Server: KazaaClient Jul 15 2002 20:37:36 

Connection: close 

Last-Modified: Tue, 15 Oct 2002 15:36:45 GMT 
X-Kazaa-Username: illegalhost 
X-Kazaa-Network: KaZaA 
X-Kazaa-IP: 123.52.193.31:1214 
X-Kazaa-SupernodelP: 198.37.26.79:2577 
X-KazaaTag: 5=427 
X-KazaaTag: 21=128 
X-KazaaTag: 6=Michael Jackson 
X-KazaaTag: 8 = Thriller 
X-KazaaTag: 4=Thriller 

X-KazaaTag: 3==0GM/G/3Q/eSM81HvjFQbZlZ0Jt0= 
Content-Type: audio/mpeg 

[DATA] 



FIG. 13 



1 GET http://81.65.32.7:6346/uri- 

res/N2R?urn:shal:F3HBAWBPQWOS5G5GBCDBPYDMG5NZIA2P HTTP/1.1 

2 Host: 81.65.32.7:6346 

3 User-Agent: Morpheus 3.3.0.24 (GnucDNA 0.9.2.6) 

4 Listen-IP: 206.170.247.13:13484 

5 Connection: Keep-Alive 

6 Proxy-Connection: close 

7 Range: bytes=104144-524287 
8X-Queue: 0.1 

9 X-Gnutella-Content-URN: urn:shal:F3HBAWBPQWOS5G5GBCDBPYDMG5NZIA2P 



FIG. 14 
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HTTP 200 OK 
Server: Gnutella 
Content-Length: 6825402 
Content-Type: audio/mpeg 

[DATA] 



FIG. 15 



FTP involves one connection, typically through a Telnet implementation. Commands are 
sent and replies are received over the same connection. Downloads are initiated using the 
FTP RETRIEVE command as follows. Note this is after a connection has been established. 

If the FTP site's IP address is in the suspicious IP address database, SocketBreaker will 
match the following command against the Illegal Content Database: 

RETR Michael-Jackson-Thriller.zip 
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FIG. 16 



